It’s still unclear how far back the trojanized versions began to get served to customers but, as Satnam Narang, staff research engineer at Tenable, pointed out, “3CX customers reported receiving threat alerts from SentinelOne as early as March 22.” Who’s behind it?ģCX’s investigation will hopefully soon reveal the exact moment their legitimate apps have been switched with trojanized ones, and will be able to share how their delivery infrastructure has been compromised. Both companies (and Sophos, and SentinelOne) have provided indicators or compromise 3CX customers can use to find evidence of compromise on their systems.

So, until 3CX finish their investigation and we know more, customers would do well to find and uninstall them. What happened?ģCX CISO Pierre Jourdan says that the Windows version of the 3CX client app (based on the Electron framework) has been injected with malware, advised users to uninstall the app for the time being and use the PWA version until they are able to push out a clean version.īut Trend Micro and Crowdstrike researchers say that macOS versions of the 3CX desktop app have been trojanized, as well.

The company lists many high-profile companies and organizations among its 600,000+ enterprise customers.

Suspected state-sponsored threat actors have trojanized the official Windows desktop app of the widely used 3CX softphone solution, a number of cybersecurity companies began warning on Wednesday.ģCX is Voice over Internet Protocol (VoIP) private automatic branch exchange (PABX) software that provides video conferencing and live chat capabilities.ģCX offers a Windows, macOS, Linux, Android and iOS version of the app, a Chrome extension, and the PWA ( progressive web app) version so the software can be also used via any browser.

Nexus 18.12